STATEMENT
OF
NORMAN E. LORENTZ
ACTING ADMINISTRATOR FOR ELECTRONIC GOVERNMENT AND
INFORMATION TECHNOLOGY
OFFICE OF MANAGEMENT AND BUDGET
BEFORE THE
COMMITTEE ON GOVERNMENT REFORM
SUBCOMMITTEE ON TECHNOLOGY, INFORMATION POLICY, INTERGOVERNMENTAL RELATIONS,
AND THE CENSUS
U.S. HOUSE OF REPRESENTATIVES

September 10, 2003

Good morning,
Mr. Chairman and Members of the Committee. Thank you for inviting me to
discuss the important topic of worm and virus defense. My testimony today
will address how the federal government protects its IT systems from this
pervasive threat.

By design,
worms and viruses can cause substantial damage and prove disruptive to
normal business operations. For this reason, it is important that federal
agencies continually and rapidly take proactive measures to lessen the
number of successful attacks.

The month
of August proved unusually busy for malicious code activity, beginning
with the Blaster and then the quickly spreading Sobig.f worm. I am pleased
to state that, in general, the federal government withstood these attacks
and impact on citizen services was minimal. Agencies have improved their
protection against malicious code by installing patches, blocking executables
at the firewall, and using anti-virus software with automatic updates.

Agencies
did, however, report modest impacts associated with the Blaster and Sobig.f
worms. To date, reports from federal civilian agencies show approximately
1000 computers affected by each exploit. This impact ranged from a slowdown
in agency e-mail to the temporary unavailability of internal agency systems.
A number of laptops proved to be susceptible to infection since configuration
management was uneven on these portable devices.

The federal
government's ability to thwart worms and viruses depends on a number of
interlocking management, technical and operational controls. It is critical
that these controls continue to evolve to keep pace with the increasingly
sophisticated threat.

How
vulnerabilities are discovered

DHS' Federal
Computer Incident Response Center (FedCIRC) maintains a strong relationship
with a number of industry as well as government partners. These partners
include commercial software vendors, Carnegie Mellon Universitys
Computer Emergency Response Team, law enforcement, the intelligence community,
and agency incident response teams. These organizations routinely communicate
advance notice to DHS regarding the discovery of software vulnerabilities
and the development of malicious code designed to exploit these weaknesses.

How
Agencies Are Notified About Potential Vulnerabilities

The Federal
Computer Incident Response Center within the Department of Homeland Security
is the Federal governments focal point for coordinating response
to attacks (non-law enforcement), promoting incident reporting, and cross-agency
sharing of data about common vulnerabilities. Through this role, FedCIRC
notifies Federal agencies about current and potential information security
threats and vulnerabilities.

OMB and the
CIO Council have developed and deployed a process to rapidly counteract
identified threats and vulnerabilities. CIOs are advised via conference
call, as well as follow up e-mail, of specific actions needed to protect
agency systems. This information is also transmitted to agency incident
response centers. Agencies must then report through FedCIRC to OMB on
the implementation of the required countermeasures. In particular, we
track data concerning the percentage of systems patched and the time needed
to complete mitigation efforts. This emergency notification and reporting
process was instituted for the Microsoft RPC vulnerability in July and
as a result, agencies were able to rapidly close vulnerabilities that
otherwise might have been exploited by the Blaster worm.

In analyzing
agency responses to earlier OMB data calls, it became apparent that the
amount of time needed to implement required fixes was too long and varied
widely from agency to agency. OMB asked the CIO Councils Security
Liaison to sponsor a meeting so that agencies could share best practices.
The meeting ensured that agency CIOs understood the urgency associated
with implementing patches and were able to leverage the capabilities and
ideas of other agencies.

OMB continued
to discuss the Blaster and Sobig.f worms with key agency representatives.
Sector specific agencies such as Treasury, Energy and Transportation provided
updates on the worms impact to the private sector and agencies
participated in a discussion of lessons learned and next steps. OMB intends
to hold after action meetings with federal agencies following all major
cyber events so that we may continue to refine this process.

The
Mechanisms that Exist for Protecting Systems

The National
Institute of Standards and Technology (NIST) provides guidelines to federal
agencies on securing networks, systems, and applications. NIST recommends
that agencies implement a patch management program, harden all hosts appropriately,
deploy antivirus software to detect and block malicious code, and configure
the network perimeter to deny all traffic that is not necessary. Additional
recommendations include user awareness briefings as well as training for
technical staff on security standards, procedures, and sound security
practices. Per longstanding OMB policy, Federal agencies are directed
to follow NIST guidelines.

As part of
its statutory responsibilities under the Federal Information Security
Management Act, the National Institute of Standards and Technology will
publish in September draft guidelines for incident handling. The guidelines
will discuss how to establish and maintain an effective incident response
program with an emphasis on incident detection, analysis, prioritization
and containment. The guidelines will include recommendations for handling
certain types of incidents, such as distributed denial of service attacks
and malicious code infections. In addition, the guidelines will include
a set of sample incident scenarios that can be used to perform incident
response team exercises. The guidelines will be written so they can be
followed regardless of hardware platform, operating system, protocol,
or application.

Another critical
mechanism used to enforce protection of Federal systems is the Federal
Information Security Management Act (FISMA). Under FISMA, Federal agencies
are required to periodically test and evaluate the effectiveness of their
information security policies, procedures and practices. The results of
both the agency self assessments and the IG assessments are provided to
OMB each September. OMB submits a summary report to Congress based on
the agency and IG reports.

The
Problems Presented by Patching Systems

Patch management
is an essential part of an agencys information security program
and requires a substantial investment of time and effort. Agencies must
carefully follow predefined processes in order to successfully remediate
system vulnerabilities across the enterprise.

These processes
include: identifying all affected systems and related software revision
levels, fully testing the patch before it is placed into a production
environment, and prioritizing installation of the patch based on the criticality
of the system. Alternative solutions such as judicious use of port blocking
must be implemented if the patch cannot be installed.

A number
of agencies utilize automated tools to push patches to the desktop. The
automation of the patch management process is significantly easier if
the agency maintains standardized software configurations.

At the present
time, forty-seven agencies subscribe to FedCIRCs Patch Authentication
and Dissemination Capability. This service validates and quickly distributes
corrective patches for known vulnerabilities.

Federal
Enterprise Architecture

Improving
the federal governments response to malicious code requires that
we focus on enterprise architecture and the standardized deployment of
security technologies. As new technologies become available and cost effective,
they must be incorporated into the IT infrastructure where they can monitor
common precursors and indications of attack.

Conclusion

The Federal
government is the worlds largest consumer of IT systems. Because
of its vast inventory and the vulnerabilities inherent in commercial software,
the Federal government will, for the immediate future, continue to be
impacted by the proliferation of worms and viruses. Through our oversight
of agency security policies and practices, OMB will continue to work with
agencies to ensure that the risks associated with malicious code are appropriately
mitigated.

In addition,
the federal government will continue to rely on federal, state and local
law enforcement to investigate and prosecute developers of malicious code.
Agencies must continue to report computer incidents and assist law enforcement
investigations to the greatest extent possible. Strong cooperation was
displayed between the FedCIRC community and the Secret Service, FBI and
other law enforcement officials during the recent Blaster and Sobig.F
incidents.

In closing,
OMB is committed to a federal government with resilient information systems.
Worms and viruses must not be allowed to significantly affect agency business
processes. OMB will continue to work with agencies and the Congress to
ensure that appropriate countermeasures are in place to reduce the impact
of malicious code.